Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 126 published records · 0 KEV · 126 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

126 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low126100%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Dec 25126

Signal coverage

KEV-listed: 0
With a forecast: 126
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.00% · forecast 100% · unscored 0.00%.

Showing 1–20 of 126By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 126, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

LowPublished 01 Jan 2026, 06:20 WIB

CVE-2025-69412

CVE-2025-69412

KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration.

Excerpt language: en.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-31T23:20:55.785Z. Updated 2026-01-02T13:45:18.339Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated02 Jan 2026, 20:45 WIB

Official record

LowPublished 31 Dec 2025, 07:58 WIB

CVE-2025-11964

OOBW in utf_16le_to_utf_8_truncated() in libpcap

On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.

Excerpt language: en.

Severity low: primary CNA CVSS 1.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-31T00:58:19.026Z. Updated 2026-01-02T14:38:10.106Z.

Showing 1 to 20 of 126.Next page

CVSS1.9v3.1

KEVNot listed

EPSSPresent

Updated02 Jan 2026, 21:38 WIB

Official record

LowPublished 31 Dec 2025, 07:56 WIB

CVE-2025-11961

OOBR and OOBW in pcap_ether_aton() in libpcap

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-31T00:56:16.310Z. Updated 2026-01-02T14:38:16.719Z.

CVSS1.9v3.1KEVNot listedEPSSPresentUpdated02 Jan 2026, 21:38 WIB

Official record

LowPublished 31 Dec 2025, 04:03 WIB

CVE-2025-61594

URI Credential Leakage Bypass over CVE-2025-27221

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T21:03:08.990Z. Updated 2026-04-16T17:02:32.149Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated17 Apr 2026, 00:02 WIB

Official record

LowPublished 31 Dec 2025, 03:17 WIB

CVE-2025-14986

ExecuteMultiOperation Namespace Policy Bypass

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T20:17:47.201Z. Updated 2026-01-02T15:31:02.796Z.

CVSS1.3v4.0KEVNot listedEPSSPresentUpdated02 Jan 2026, 22:31 WIB

Official record

LowPublished 31 Dec 2025, 02:23 WIB

CVE-2025-69210

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendere…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T19:23:31.130Z. Updated 2025-12-30T19:47:52.458Z.

CVSS1.2v4.0KEVNot listedEPSSPresentUpdated31 Dec 2025, 02:47 WIB

Official record

LowPublished 30 Dec 2025, 23:11 WIB

CVE-2025-67746

Composer vulnerable to ANSI sequence injection

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T16:11:04.776Z. Updated 2025-12-30T17:30:04.562Z.

CVSS1.3v4.0KEVNot listedEPSSPresentUpdated31 Dec 2025, 00:30 WIB

Official record

LowPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69015

WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

Excerpt language: en.

Severity low: primary CNA CVSS 3.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T10:47:53.892Z. Updated 2026-04-28T16:14:34.426Z.

CVSS3.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

LowPublished 30 Dec 2025, 16:32 WIB

CVE-2025-15242

PHPEMS Coupon race condition

A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T09:32:07.221Z. Updated 2026-02-24T06:15:47.302Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:15 WIB

Official record

LowPublished 30 Dec 2025, 12:32 WIB

CVE-2025-15222

Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization

A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high complexity. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T05:32:05.705Z. Updated 2025-12-30T14:56:32.958Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:56 WIB

Official record

LowPublished 28 Dec 2025, 22:02 WIB

CVE-2025-15141

Halo Configuration actuator information disclosure

A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high complexity. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T15:02:05.484Z. Updated 2026-02-24T06:07:11.149Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:07 WIB

Official record

LowPublished 28 Dec 2025, 14:32 WIB

CVE-2025-15126

JeecgBoot getPositionUserList improper authorization

A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rath…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T07:32:06.264Z. Updated 2025-12-29T16:03:06.162Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:03 WIB

Official record

LowPublished 28 Dec 2025, 14:02 WIB

CVE-2025-15125

JeecgBoot queryDepartPermission improper authorization

A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in improper authorization. The attack can be launched remotely. This attack is characterized by high complexit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T07:02:06.680Z. Updated 2025-12-29T16:03:49.238Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:03 WIB

Official record

LowPublished 28 Dec 2025, 13:32 WIB

CVE-2025-15124

JeecgBoot list getParameterMap improper authorization

A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation of the argument departId leads to improper authorization. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T06:32:06.920Z. Updated 2025-12-29T16:04:32.586Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:04 WIB

Official record

LowPublished 28 Dec 2025, 13:02 WIB

CVE-2025-15123

JeecgBoot datarule improper authorization

A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is reporte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T06:02:05.781Z. Updated 2025-12-29T16:05:08.309Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:05 WIB

Official record

LowPublished 28 Dec 2025, 12:02 WIB

CVE-2025-15122

JeecgBoot datarule loadDatarule improper authorization

A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is considered to have high…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T05:02:05.798Z. Updated 2025-12-29T16:42:57.874Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:42 WIB

Official record

LowPublished 28 Dec 2025, 11:02 WIB

CVE-2025-15120

JeecgBoot getDeptRoleList improper authorization

A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T04:02:06.291Z. Updated 2025-12-29T16:40:55.481Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:40 WIB

Official record

LowPublished 28 Dec 2025, 10:32 WIB

CVE-2025-15119

JeecgBoot list queryPageList improper authorization

A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T03:32:06.719Z. Updated 2025-12-29T19:04:57.949Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 02:04 WIB

Official record

LowPublished 28 Dec 2025, 09:32 WIB

CVE-2025-15117

Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization

A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T02:32:05.652Z. Updated 2025-12-29T16:39:15.402Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:39 WIB

Official record

LowPublished 27 Dec 2025, 06:43 WIB

CVE-2025-68932

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeove…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T23:43:34.693Z. Updated 2025-12-29T16:51:53.481Z.

CVSS2.9v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:51 WIB

Official record